Possible incompatibility between Cylance and 1Password mini?

billpr

Over the last few months, I've been occasionally getting into a state whereby my OSX Terminal window refuses to work properly. After much sleuthing, and looking at Activity Monitor, I tracked it down to a situation whereby PIPED commands are failing.

That is to say, if I run a program in bash and have the output go through the pipe operator (|) to another program, it's like the pipe is blocked from operating properly...

I am running an antivirus package known as Cylance - and had suspected that was interfering with my computer's operation -- but in isolating the situation, I closed all programs and finally closed the 1Password Mini menu-bar application, and to my complete and utter surprise, my system started working again!

Environment:
OSX 10.10.5 (fully patched)
bash (GNU bash, version 4.4.5(1)-release (x86_64-apple-darwin14.5.0) via homebrew)
also verified when using the bash supplied by Apple for this release, (GNU bash, version 3.2.57(1)-release (x86_64-apple-darwin14))
1Password 6 (version 6.5.2 (652003) installed via AgileBits Store
1Password extension 4.6.2.90 installed to Google Chrome 54.0.2840.98 (64-bit)

As example, using the 'hostinfo' program which is supplied by OSX in /usr/bin/hostinfo as a 64bit application

[billm@Bill-MBP tmp]$ file `which hostinfo`
/usr/bin/hostinfo: Mach-O universal binary with 2 architectures
/usr/bin/hostinfo (for architecture i386):    Mach-O executable i386
/usr/bin/hostinfo (for architecture x86_64):    Mach-O 64-bit executable x86_64

[billm@Bill-MBP tmp]$ hostinfo
Mach kernel version:
     Darwin Kernel Version 14.5.0: Sun Sep 25 22:07:15 PDT 2016; root:xnu-2782.50.9~1/RELEASE_X86_64
Kernel configured for up to 8 processors.
4 processors are physically available.
8 processors are logically available.
Processor type: i486 (Intel 80486)
Processors active: 0 1 2 3 4 5 6 7
Primary memory available: 16.00 gigabytes
Default processor set: 338 tasks, 2185 threads, 8 processors
Load average: 2.25, Mach factor: 5.74

Now I take this program, which did run, and pass it through a 64bit filter program (/usr/bin/more)

[billm@Bill-MBP tmp]$ /usr/bin/hostinfo |/usr/bin/more

it hangs.

If I try to take the hostinfo output and pass it through perl (forced into 32bit mode) it still fails.

/usr/bin/hostinfo |arch -i386 perl -n -e 'print;'
^C

I searched the web for some precedence to see if what I was experiencing may be found by others, and I found a link at
http://stackoverflow.com/questions/37759544/git-stash-freezes-console-becomes-unresponsive wherein some people suspect it's a problem with 32bit applications vs. 64bit applications being blocked.

Using a C program that just reads from stdin and outputs what's been read, I can also reproduce this.

[billm@Bill-MBP tmp]$ cat readloop.c
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv) {
  char buffer[1024];

  while ((fgets(buffer, sizeof(buffer), stdin))!=NULL) {
      printf("%s", buffer);
  }
  return 0;
}

[billm@Bill-MBP tmp]$ cc -o readloop readloop.c
[billm@Bill-MBP tmp]$ echo testing |./readloop
testing
[billm@Bill-MBP tmp]$ arch -i386 hostinfo |./readloop
^C

However, as soon as I closed the 1Password Mini application, all of the above tests start to work again!!

---

1Password Version: 6.5.2 (652003)
Extension Version: 4.6.2.90
OS Version: 10.10.5
Sync Type: dropbox
Referrer: forum-search:cylance

AGAlumB

@billpr: Thanks for reaching out. I’m sorry for the trouble ! It wouldn't be an "incompatibility" per se, but anything that blocks, intercepts, or filters local traffic may cause trouble for 1Password, which is trying to establish a websockets connection to its browser extensions. 1Password can also use a variety of ports, in case some are unavailable:

How to configure your firewall, proxy, or other network software for 1Password

Note that I've actually linked the Windows section there, since it contains a list of ports. This simply doesn't come up on the macOS side much at all, so I've never heard of an issue remotely like what you're describing outside of a PC environment.

And, to be clear, this is backwards: I haven't heard of 1Password blocking things. Ever. It simply isn't in that business. It just wants to talk to the browser. So if there's some kind of interaction there, it would be good to know about. Would you be willing to provide some more detailed diagnostic information? Let me know what you find!

billpr

Not definitive that it was 1Password, but I had literally closed all other applications on my MBP,and was still seeing the snafu when trying to run.

It could be something to do with number of file handles, or Cylance suspecting 1Password of nefarious activity. I figured by posting with as much details as possible, if somebody else has a similar issue, we can compare notes.

Thanks!

AGAlumB

Absolutely! You did the right thing. Thanks for letting us know! I haven't seen other reports like this, but we'll definitely be on the lookout.